This seem to happen when host authenticity is not established i.e. when git shows prompts like this:

The authenticity of host 'gitlab.com (52.167.219.168)' can't be established.
ECDSA key fingerprint is SHA256:HbW3g8zUjNSksFbqTiUWPWg2Bq1x8xdGUrliXFzSnUw.
Are you sure you want to continue connecting (yes/no)?

From what I understand this should have been solved by #1001 but looks like it doesn;t work for host authenticity prompt.

Workaround: Make sure it is possible to clone the repository using git.

Comment by Jeremy Fillingim (JIRA)

I'm not experiencing the particular issue that you are pointing out (meaning I don't have the host authenticity issue) when I clone my private repositories with git via both https and ssh.

I'm working around it by using Swift 3.0.1 (where the issue does not exist), but it was disappointing to encounter a flaw of this type in an official release.

Here is a capture of some (hopefully) illustrative commands:

When I clone the following repository via https, it prompts me for username and password, and succeeds.

$ git clone https://gitlab.com/XYZ/systemmodules
Cloning into 'systemmodules'...
Username for 'https://gitlab.com': jfilling
Password for 'https://jfilling@gitlab.com':
remote: Counting objects: 14, done.
remote: Compressing objects: 100% (13/13), done.
remote: Total 14 (delta 2), reused 0 (delta 0)
Unpacking objects: 100% (14/14), done.

When the fetch happens through swift, I am prompted for a username, then nothing else happens.

$ swift package fetch
Fetching https://gitlab.com/XYZ/systemmodules
Username for 'https://gitlab.com': jfilling

I have a line in my Package.swift file that looks like:

dependencies: [ .Package(url: "https://gitlab.com/XYZ/systemmodules", majorVersion: 1) ],

That patch probably hasn't made into the 3.1 release then. I suggest using a SSH key and git+ssh instead of https.
Note: That patch doesn't fix the prompt issue but just errors out instead of hanging.